CVE-2019-3570 is a vulnerability in Facebook Hiphop Virtual Machine
Published on July 18, 2019
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
Weakness Type
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Products Associated with CVE-2019-3570
Want to know whenever a new CVE is published for Facebook Hiphop Virtual Machine? stack.watch will email you.
Affected Versions
Facebook HHVM:- Version 4.8.1 is affected.
- Version 4.8.0 is affected.
- Version 4.7.1 is affected.
- Version 4.7.0 is affected.
- Version 4.6.1 is affected.
- Version 4.6.0 is affected.
- Version 4.5.1 is affected.
- Version 4.5.0 is affected.
- Version 4.4.1 is affected.
- Version 4.4.0 is affected.
- Version 4.3.1 is affected.
- Version 4.0.0 and below unspecified is affected.
- Version 3.30.6 is affected.
- Version unspecified, <= 3.30.5 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.